Trust & Security

How this website handles what you send it, what protects it, and what it depends on. Everything on this page describes the code as deployed, and the headers and dependencies are checked against the source by automated tests.

security headers on every response: 7
third-party origins allowed by the CSP: 0
runtime dependencies: 9
Content-Security-Policy directives: 11

Isometric illustration of a submission path: requests pass origin, size, rate and field checks; one is refused and set aside; the rest reach an encrypted store.

Data sources

Live systems and research material, kept apart.

The website’s security, data handling and connected tools run on live systems. Quantix Protocol Research is research material, shown with its source and date wherever it appears.

Live and connected

The form endpoint, its validation, rate limiting and delivery
Security headers, Content-Security-Policy and staff sign-in
Connected tools — Token Scanner, monitoring, address intelligence, transaction graph and Contract Analyzer — which read public chain and provider data when a provider is configured, and state the source and time of every result
PDF generation, CSV exports and the Merkle proof verifier
Descriptions of standards, vulnerability classes, EIPs and tooling
This page, the privacy policy and the disclosure policy

Quantix Protocol Research

Protocol profiles and their research assessments
Risk scores, grades and maturity ratings of the protocol profiles
Recorded investigations: monitoring events, threat analyses and forensic case files
Case studies, researcher programmes and team roles

Prepared by Quantix researchers on modelled protocol designs; not a record of client engagements, organisations or people. See the security disclaimer.

Data path

Where a form submission goes.

Forms are the only way the website collects personal information. This is the complete path, with the delivery channels configured on this deployment.

01Always
Your browser
The form is checked as you type, then sent over HTTPS as JSON to this website only; the Content-Security-Policy forbids sending it anywhere else.
02Always
Form endpoint
POST /api/inquiries
- Accepts JSON only, from this website’s own pages (Origin must match the host).
- At most 5 submissions per IP address in 10 minutes.
- Requests larger than 48 KB are refused.
- A hidden trap field must be empty, and the form must have been open between 3 seconds and 24 hours.
- Every field is validated on the server: required fields, lengths, formats and allowed values.
- A success message and reference number are returned only after a delivery channel accepted the submission.
1. 03aIn use
  Email delivery
  Resend API → operator inbox
  Delivered to the recipients configured for the form’s topic, with your email as reply-to and the reference number as an idempotency key, so a retry cannot send twice.
2. 03bNot configured
  Encrypted store
  AES-256-GCM → Upstash Redis
  Optional. Each record is encrypted on the server before it is written, bound to its reference number, and expires automatically after the configured retention period. Without an encryption key nothing is stored.

What each form collects

Read from the same validation schema the server enforces, so this list cannot drift from the code. Retention and your rights are covered in the privacy policy.

Fields collected by each form on this website
Form	Fields (required fields marked *)
Audit requestRequest an audit	Full name, Work email, Organization, Website, Blockchain ecosystem, Service required, Project stage, Repository URL, Estimated codebase size, Preferred timeline, Project description*
Contact inquiryContact	Your name, Email, Organization, Topic, Message
Incident response inquiryIncident response	Your name, Email, Organization or project, Blockchain ecosystem, Incident status, What happened, Transaction hashes or addresses, Secure contact method
Research submissionResearcher submissions	Name or handle, Email, Research programme, Affected component, Vulnerability class, Severity (your assessment), Description, Steps to reproduce, Impact*, Proof-of-concept repository URL

Not collected

No tracking, no analytics, no third-party scripts.

Visitors get no cookies, and nothing loads from other origins: fonts, icons and scripts are served from the site itself. Staff who sign in to the admin panel or audit workspace receive one strictly necessary session cookie. The security tools query blockchain and security providers from the server, never from your browser.

Service providers involved in running the website and their status on this deployment
Provider	Role	Data it sees	This deployment
Hosting platform	Serves the website and runs its server code.	Standard request data: IP address, user agent, requested address, time. Form submissions pass through it in transit.	Always
Resend	Email delivery API that forwards each form submission to the operator’s inbox.	The fields you submitted, the reference number and the time of receipt.	In use
Upstash (Redis over REST)	Optional store for encrypted copies of submissions, and a shared counter for rate limiting.	Encrypted submission records (AES-256-GCM; the store never sees plaintext) and short-lived counters keyed by IP address.	Not configured
PostgreSQL database host	Stores the platform’s results: token scans, analyses, monitoring events, risk-score history, and the accounts and sessions of staff who sign in.	Addresses, networks and source code or repository URLs you submit to the security tools, with their results; for staff, email, name, password hash and session records.	In use
Blockchain RPC provider	Answers read-only blockchain queries made by the server for the token scanner, address intelligence, transaction graph, monitoring and protocol pages.	The contract or wallet address and network you enter. Requests are made by the server, not your browser.	Not configured
Etherscan API	Verified source code, ABI and contract metadata; transaction lists where the plan allows.	Contract and wallet addresses you scan or analyse.	Not configured
GoPlus Security API	Token security signals and malicious-address flags.	Token and wallet addresses you scan.	In use
DefiLlama API	Protocol TVL and its history for the public-protocol pages.	Protocol identifiers only; no data about you.	In use
CoinGecko API	Token price, market capitalisation and trading volume for the public-protocol pages.	Coin identifiers only; no data about you.	Not configured

Security headers

Sent with every response.

Configured in next.config.ts and applied to every route. The X-Powered-By header is disabled. Values shown are the production values; development builds additionally allow 'unsafe-eval' for hot reloading.

Content-Security-Policy

Restricts where scripts, styles, images, fonts and requests may come from or go to. Directives are listed below.

Strict-Transport-Security

Browsers must use HTTPS for this site and its subdomains for two years after a visit.

max-age=63072000; includeSubDomains; preload

X-Content-Type-Options

Browsers must not guess content types, which blocks some script-injection techniques.

nosniff

X-Frame-Options

Legacy clickjacking protection, alongside frame-ancestors.

DENY

Referrer-Policy

Other sites you follow a link to see only this site’s origin, never the full page address.

strict-origin-when-cross-origin

Permissions-Policy

Camera, microphone, location, payment and USB access are disabled for every page.

camera=(), microphone=(), geolocation=(), payment=(), usb=()

Cross-Origin-Opener-Policy

Isolates this site’s windows from pages opened from other origins.

same-origin

Content-Security-Policy directives

default-src 'self'
Anything not covered by another directive may only load from this website.
script-src 'self' 'unsafe-inline'
Scripts come only from this website. Inline scripts are allowed for the framework’s hydration data; no third-party script origin is permitted.
style-src 'self' 'unsafe-inline'
Stylesheets come only from this website; inline styles are used for chart colours and layout.
img-src 'self' data: blob:
Images come from this website, or are generated in the page (charts, downloads).
font-src 'self'
Fonts are self-hosted. No request goes to a font provider.
connect-src 'self'
The page can only send requests to this website, so form data cannot be sent anywhere else from the browser.
frame-ancestors 'none'
No other site may embed these pages in a frame (clickjacking protection).
base-uri 'self'
Prevents an injected <base> tag from redirecting relative links.
form-action 'self'
Forms may only submit to this website.
object-src 'none'
Plugins and embedded objects are disabled.
upgrade-insecure-requests
Any http:// sub-resource is requested over HTTPS instead.

Dependencies

A small, inspectable supply chain.

The runtime dependencies, read from package.json at build time. There are no analytics, tag-manager or third-party client SDKs.

Runtime dependencies, version ranges and purpose
Package	Version range	Why it is there
@pdf-lib/fontkit	^1.1.1	Embeds the site’s own fonts into generated PDF documents.
drizzle-orm	^0.45.4	Database toolkit: schema, migrations and parameterised queries for PostgreSQL.
lucide-react	^1.61.0	Icon set, compiled into the pages; no icon font or external request.
next	^16.4.3	Web framework: routing, server rendering, the form API route and security headers.
pdf-lib	^1.17.1	Generates the Technical Security Assessment PDF documents on the server.
pg	^8.23.1	PostgreSQL client used by the server and the background worker.
react	^19.3.1	User-interface library.
react-dom	^19.3.1	Renders React components in the browser and on the server.
server-only	^0.0.1	Build-time guard that stops server code (such as the email client) from being bundled into browser code.

Server-only configuration

Read only by server code. Never included in pages or scripts sent to the browser.

RESEND_API_KEY: Authenticates email delivery of form submissions.
INQUIRY_FROM_EMAIL: Sender address on delivered submissions.
INQUIRY_TO_EMAIL: Recipients of form submissions.
INQUIRY_TO_EMAIL_INCIDENT: Optional recipients for incident requests.
INQUIRY_TO_EMAIL_DISCLOSURE: Optional recipients for vulnerability reports and research submissions.
UPSTASH_REDIS_REST_URL: Optional encrypted store and shared rate-limit counter.
UPSTASH_REDIS_REST_TOKEN: Authenticates the store.
INQUIRY_ENCRYPTION_KEY: 32-byte AES-256-GCM key; without it nothing is stored.
INQUIRY_RETENTION_DAYS: Expiry of stored submissions (default 365 days).
DATABASE_URL / DIRECT_URL: PostgreSQL connections for the app, the worker and migrations.
ALCHEMY_API_KEY: Blockchain RPC and transfer/token APIs for all supported networks.
ALCHEMY_WEBHOOK_SIGNING_KEY: Verifies the signature of incoming Alchemy webhooks.
RPC_URL_*: Optional RPC endpoint per network, overriding Alchemy.
ETHERSCAN_API_KEY: Verified source, ABI and contract metadata (Etherscan API V2).
GOPLUS_APP_KEY / GOPLUS_APP_SECRET: Optional higher GoPlus Security limits.
DEFILLAMA_API_KEY / COINGECKO_API_KEY: Optional Pro access to protocol and market data.
CRON_SECRET / WORKER_SIGNING_SECRET: Authenticate scheduled and internal job requests.
ANALYZER_*: Contract Analyzer sandbox mode, tools and limits (analyzer worker only).

Public configuration

Compiled into pages. Empty values hide the item rather than showing an invented one.

NEXT_PUBLIC_SITE_URL: Canonical address of the website.
NEXT_PUBLIC_CONTACT_EMAIL_*: Contact addresses, shown only when set.
NEXT_PUBLIC_PGP_KEY_URL / _FINGERPRINT: Public key for encrypted vulnerability reports.
NEXT_PUBLIC_SOCIAL_*: Social profile links, shown only when set.

Policies

The documents behind this page.

Trust & security

Legal